The industry-wide concerns is that the default environment is: 1. Almost no company (with very few exceptions, like Google) can secure their systems. 2. A tec

The industry-wide concerns is that the default environment is: 1. Almost no company (with very few exceptions, like Google) can secure their systems. 2. A tech industry culture of treating customer data as something to be captured, often secretly, and leveraged, as well as a culture of being "naughty" about bending rules and regulations in general. If you want to do much better than this, that's awesome. You're probably aware that the following common measures aren't adequate: * Corporate compliance checklists, which are done because they're required, or for show, while denying responsibility, and knowing that they are ineffective. * Making security a marketing brochure checklist item or selling point, but having no idea how to do it better than the abysmal industry practice. * Projecting confidence. * Trying to make the customer comfortable, rather than actually securing the data.